Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4.
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
Problem type
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-83: Improper Neutralization of Script in Attributes in a Web Page
- CWE-116: Improper Encoding or Escaping of Output
Affected products
withastro
>= 3.10.0, < 7.0.4 - AFFECTED
References
https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2
https://github.com/withastro/astro/pull/17212
https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294
https://github.com/withastro/astro/releases/tag/astro@7.0.4
GitHub Security Advisories
GHSA-7pw4-f3q4-r2p2
Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands
https://github.com/advisories/GHSA-7pw4-f3q4-r2p2Summary
When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS).
Severity
Although a generic reflected XSS scores in the Medium range, exploitation here requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This mitigating precondition places the real-world severity at Low.
Details
In generateHydrateScript() (packages/astro/src/runtime/server/hydration.ts), every island property is HTML-escaped before serialization — the attrs, props, and opts assignments all pass through escapeHTML(). The transition directives, however, were copied verbatim:
transitionDirectivesToCopyOnIsland.forEach((name) => {
if (typeof props[name] !== 'undefined') {
island.props[name] = props[name]; // not escaped
}
});
The <astro-island> element is serialized via renderElement('astro-island', island, false) with shouldEscape=false, and toAttributeString() returns the value unchanged in that mode. As a result there is no downstream re-escaping, and the raw directive value reaches the HTML response. This is the same output sink previously addressed for slot names in GHSA-8hv8-536x-4wqp.
The affected directives are:
data-astro-transition-scope(transition:scope)data-astro-transition-persist(transition:persist)data-astro-transition-persist-props(transition:persist-props)
Note that transition:persist is typed boolean | string, so passing a string value is a supported use of the API.
Proof of Concept
A component that reflects a query parameter into a transition directive:
---
const persist = Astro.url.searchParams.get('persist') ?? 'default';
---
<Island client:load transition:persist={persist} />
Request:
https://example.com/?persist="><img src=x onerror=alert(document.domain)>
Rendered output (before the fix):
<astro-island … data-astro-transition-persist=""><img src=x onerror=alert(document.domain)>></astro-island>
The " closes the attribute and the injected <img onerror=…> executes in the victim's browser.
Impact
Reflected XSS. An attacker who can induce a victim to visit a crafted URL can execute arbitrary script in the victim's session on the origin, subject to the requirement that the target application reflects untrusted input into one of the affected transition directives.
Affected Versions
astro >= 3.10.0, < 7.0.4 (introduced in 3.10.0, PR #7861).
Patched Versions
astro >= 7.0.4. Fixed in PR #17212 by HTML-escaping transition directive values before they are rendered onto the island element.
Workarounds
Do not pass untrusted or request-derived input into transition:persist, transition:scope, or transition:persist-props. If such input is required, HTML-escape or strictly validate it before passing it to the directive. Upgrading to astro@7.0.4 or later removes the need for manual mitigation.
Credits
Reported by @jlgore.
https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2
https://github.com/withastro/astro/pull/17212
https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294
https://github.com/withastro/astro/releases/tag/astro@7.0.4
https://github.com/advisories/GHSA-7pw4-f3q4-r2p2
JSON source
https://cveawg.mitre.org/api/cve/CVE-2026-59727Click to expand
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-59727",
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"dateUpdated": "2026-07-27T19:42:32.222Z",
"dateReserved": "2026-07-06T15:34:16.917Z",
"datePublished": "2026-07-27T19:42:32.222Z",
"state": "PUBLISHED"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M",
"dateUpdated": "2026-07-27T19:42:32.222Z"
},
"title": "Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands",
"descriptions": [
{
"lang": "en",
"value": "Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated (client:*) component, Astro copied the directive value onto the rendered <astro-island> element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these directives, an attacker can break out of the attribute and inject arbitrary HTML/JavaScript into the server-rendered output, resulting in reflected cross-site scripting (XSS). Exploitation requires the application developer to have written a non-idiomatic pattern — passing untrusted, request-derived input directly into a transition directive. Astro applications that do not route untrusted input into these directives are unaffected. This issue has been fixed in version 7.0.4."
}
],
"affected": [
{
"vendor": "withastro",
"product": "astro",
"versions": [
{
"version": ">= 3.10.0, < 7.0.4",
"status": "affected"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')",
"cweId": "CWE-79",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-83: Improper Neutralization of Script in Attributes in a Web Page",
"cweId": "CWE-83",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"lang": "en",
"description": "CWE-116: Improper Encoding or Escaping of Output",
"cweId": "CWE-116",
"type": "CWE"
}
]
}
],
"references": [
{
"url": "https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2",
"name": "https://github.com/withastro/astro/security/advisories/GHSA-7pw4-f3q4-r2p2",
"tags": [
"x_refsource_CONFIRM"
]
},
{
"url": "https://github.com/withastro/astro/pull/17212",
"name": "https://github.com/withastro/astro/pull/17212",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294",
"name": "https://github.com/withastro/astro/commit/7ba0bb1dc7516e88caff9abd7767322af44b0294",
"tags": [
"x_refsource_MISC"
]
},
{
"url": "https://github.com/withastro/astro/releases/tag/astro@7.0.4",
"name": "https://github.com/withastro/astro/releases/tag/astro@7.0.4",
"tags": [
"x_refsource_MISC"
]
}
],
"metrics": [
{}
]
}
}
}